lib.sh download() is used by subfile handling in git.sh,
e.g. crossgcc tarballs.

they are not currently cached, but are downloaded directly
in place.

cache them, under cache/file/, saved with the name equal
to the checksum, so: cache/file/CHECKSUM

if the given cached file exists, use it as-is for simple
copy, instead of curl. this avoids re-downloading a lot of
crossgcc tarballs, where different coreboot trees may use
some archives that are the same throughout.

Signed-off-by: Leah Rowe <leah@libreboot.org>